CVE-2026-12060 describes an exposed dangerous method or function in Heptabase, a product by Hepta Platforms. This vulnerability enables unauthenticated remote attackers to leverage social engineering to induce victims to load malicious webpages inside the Heptabase application. Doing so grants attackers unauthorized access to camera and microphone permissions. The CVSS 4.0 vector indicates network attack vector, low attack complexity, no privileges required, user interaction needed, and high impact on confidentiality. No remediation level or patch information is currently available.

An attacker can remotely induce a user to open a malicious webpage within Heptabase, resulting in unauthorized access to the user's camera and microphone. This compromises user privacy and could lead to surveillance or data exfiltration. The vulnerability requires user interaction but no privileges or authentication, increasing its risk profile.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, users should exercise caution when interacting with untrusted links or content within the Heptabase application. Monitoring vendor communications for updates is recommended.